Business email compromise is the most expensive attack most organisations face, and it carries no malware for your defences to catch. We run controlled CEO fraud, fake invoice and vendor impersonation scenarios against your finance and executive teams, then show you exactly where the payment process failed.
Business email compromise simulation is a targeted exercise aimed at the small number of people in your organisation who can move money or change payment details. Where a general phishing campaign goes to everyone with a mass-market lure, a BEC simulation is researched, personalised and patient, exactly like the real thing.
Scenarios are built from public information about your organisation, the same way an attacker would build them: your leadership names from the company website and LinkedIn, your reporting lines, your announced projects, your named suppliers, and the periods when your finance team is busiest. A convincing BEC message references a real project, arrives from a domain that differs from yours by one character, and asks for something plausible.
The exercise measures a process, not just a person. Did the request get questioned? Was the bank detail change verified through an independent channel? Did the approval threshold hold, or did seniority override it? A finance controller who almost paid but called to verify is a success story, and the report says so.
BEC is quiet and disproportionately expensive. There is no malicious attachment, no malicious link and often no malicious infrastructure to detect. The email simply asks a person to do their job slightly differently, and the loss is realised at the moment a legitimate payment instruction is executed against fraudulent details.
Malaysian organisations are squarely targeted. Local variants lean on cultural and structural factors attackers understand well: strong deference to seniority, WhatsApp used for business instruction, and payment approvals that get waved through when a director says the deal will collapse otherwise. Invoice redirection against exporters, manufacturers and property developers is a persistent pattern.
Recovery is unlikely once funds move, particularly across borders. The money is layered through mule accounts within hours. Prevention is the only control that reliably works, and prevention means a payment process that does not bend under pressure from a convincing email.
Scenarios are selected with you during scoping and calibrated to your real payment workflows. We never simulate a genuine live transaction, and no real payment instruction is ever created.
A request that appears to come from your managing director or CFO, referencing a real initiative, marked confidential and time-critical, asking finance to process an urgent transfer outside the normal route. This is the classic scenario and it still works because it exploits hierarchy rather than technology.
An invoice arriving from what looks like a known supplier, matching your usual format and referencing a genuine purchase order or project, with amended bank details. We measure whether the change is verified independently or simply updated in the accounting system.
A supplier contact writing to advise that their banking has changed following an audit or a restructure, often with a plausible letterhead. This scenario tests your supplier master data controls, which in most organisations are considerably weaker than the payment approval controls.
Beyond the payment request itself, we test the surrounding workflows: payroll bank detail changes submitted by a supposed employee, urgent petty cash requests, tax and statutory payment demands, and requests to disclose aging reports or customer payment schedules.
Executives are targeted both as impersonation subjects and as victims. We test board members and senior leaders directly with credential capture attempts, calendar and travel-themed lures, and requests that exploit their assistants and gatekeepers.
Real BEC rarely stays in email. Where you authorise it, scenarios include a follow-up WhatsApp or SMS from a spoofed number reinforcing the request, because that combination is what defeats a member of staff who was on the verge of doing the right thing.
The output is a set of process findings your CFO can act on, backed by evidence from your own organisation rather than an industry statistic.
Payment controls look robust on a process map. A simulation shows what happens when a supposed director says the deal collapses at five o'clock, which is the only test that matters.
Invoice redirection is the highest-loss variant and the easiest to prevent. Simulations almost always produce a callback verification requirement against a number held on file, and that single change closes most of the exposure.
The most valuable outcome is often cultural. When the CFO publicly endorses the exercise and thanks the person who refused to process an urgent request, the organisation learns that verifying is expected rather than insubordinate.
Leaders tend to see security as something the IT department does to everyone else. Discovering that a plausible message went out under their name, built from their own public profile, reframes the conversation quickly.
Internal audit, external auditors and cyber insurers increasingly ask specifically about payment fraud controls and their testing. A dated simulation report with remediated findings is the strongest available answer.
Most remediation is process, not technology: a verification callback, a dual approval threshold, a supplier master data change control. Nearly all of it can be implemented within a quarter at almost no cost.
Typically five to seven weeks, with the reconnaissance and scenario design phases taking longer than a standard phishing campaign because the scenarios are bespoke.
BEC simulation needs sign-off at a level above the people being tested, usually the CEO, CFO or audit committee chair. We agree the target population, the impersonation subjects, the channels in scope and a hard stop rule covering what happens if someone escalates to a bank or the police. Nothing runs until that is signed.
We build the scenarios from publicly available information only: your website, filings, press coverage, professional networks and supplier announcements. The reconnaissance findings become a deliverable in their own right, because most clients are startled by how much attack material they publish about themselves.
We draft the scenarios and review them with your authorising sponsor. This is where scenarios get calibrated so they are realistic without being cruel, and where anything referencing a genuinely sensitive live matter is removed.
Scenarios run over one to two weeks. We monitor closely and stop any thread immediately if it escalates outside the agreed boundary, for example if a member of staff contacts a bank or a supplier directly. Everything is logged for the reconstruction.
For each scenario we reconstruct exactly what happened step by step: who received it, what they did, who they consulted, which control fired and which did not. This reconstruction is the most valuable part of the report, and it is why BEC simulation is worth more than a click rate.
We present findings to finance leadership and the executive sponsor, then work through the control changes: verification requirements, approval thresholds, supplier master data governance and the escalation route for a suspicious request. A retest three to six months later confirms the change stuck.
Deliverables are written for a finance and audit audience as much as a security one, because that is where the fixes have to be owned.
Every scenario documented with its design rationale, what was sent, what happened, and where the process held or failed.
Specific gaps in payment authorisation, supplier master data management and bank detail change controls, each with a recommended control and an owner.
The publicly available information used to build the scenarios, and what to consider removing or restricting to reduce the raw material available to a real attacker.
A short account of the exposure in financial terms: what could have moved, through which route, and what now prevents it.
Drafted callback verification procedures, a bank detail change control, an escalation script for finance staff and a suspicious request reporting route, ready to adapt into your own documentation.
Session materials covering the scenarios and the red flags, deliverable as an HRD Corp claimable programme where required. Related course: cybersecurity for finance teams.
If your organisation makes payments to suppliers, changes bank details on request, or has a finance team that would find it awkward to question a director, this applies to you.
Sectors with high-value supplier payments, international transactions or project-based billing carry the greatest exposure to invoice redirection.
Mid-sized organisations are the sweet spot for attackers: payment volumes are meaningful, and the controls are usually less formal than at a large enterprise.
The population is deliberately narrow. A BEC simulation targets the people who can move money or change where it goes.
A BEC simulation touches senior people and real money, so it has to be run with judgement as well as technique.
We run BEC simulation as a controls testing exercise, which is why our reporting is structured around the payment process rather than around individuals. Internal audit and the audit committee can read our findings as control deficiencies with owners and target dates, which is the form they can actually act on.
Recommendations are almost entirely process changes that cost nothing to implement: a verification callback to a number held on file, a second approver above a threshold, a change control on supplier bank details. We prioritise the two or three that would have stopped the scenarios that succeeded.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Follow-up briefings for finance and procurement teams can be delivered as HRD Corp claimable programmes for levy-contributing employers, including our ransomware and BEC awareness course. Grant approval has to be in place before delivery, so we scope the timing with you.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
